Security incident affecting Vegan Bootcamp accounts created since September 2025

Published November 2026 by We The Free

We The Free has run Vegan Bootcamp since September 2025. This notice is for anyone who created an account between 18 September 2025 and 21 October 2026. We're emailing everyone affected, but some emails may not arrive because the address no longer works or was mistyped at sign-up. If you created an account in that period, please read this whether you get the email or not.

What happened

On 21 October 2026 we found a malicious file on the Vegan Bootcamp server. It was most likely uploaded in April 2025, before We The Free took over the site, through a security flaw in a third-party file manager the site used at the time. The file came along when the site moved to our servers in September 2025. Anyone with the file's password could have accessed the site's database. Our records can't tell us whether anyone did, so we're treating it as possible.

What it involved

• your name and email address
• your password, stored in scrambled (hashed) form rather than as plain text
• your course progress and account activity, including IP addresses and browser details recorded since April 2026
• any optional answers you gave at sign-up, such as your country, gender, age group, diet and reasons for joining
• if you used the AI mentor, your conversations with it

What this could mean

Someone could use your name and email address to send you convincing fake emails, or try to work out your password if it was a weak one.

What we've done

The file has been removed and the site's keys have been replaced. We've closed the gap that let it run, and checked the server for anything else. We've logged everyone out and reset every password. We've reported this to the UK Information Commissioner's Office and to data protection authorities in Europe.

What you can do

• To log in again, set a new password at veganbootcamp.org/forgot-password.
• If you used your Vegan Bootcamp password anywhere else, change it there too. A different password for each account is safest.
• Be careful with emails that mention Vegan Bootcamp and ask you to log in, pay or download something. We will never ask for your password.

Questions

We're really sorry this happened. If you have any questions, write to us at security@activism.wtf. If you also had an account before September 2025, please read Vegan Hacktivists' notice too.